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IN THE CLAIMS 

1. (Currently Amended) An apparatus comprising: 

a network interface module to connect the apparatus to a network; 
a packet capture module to intercept packets being transmitted on the 
network; 

an object assembly module to reconstruct flows representing objects being 
transmitted on the network from the intercepted packets; 

an object classification module to determine a type of content of and 
reconstruct objects from the flows; 

an object store module to store the objects; and 

a user interface to enable a user to search objects stored in the object store 
module , wherein the objects are searched based on a query T which includes search 
criteria used t o identify selected objects that match the search criteria . 

2. (Original) The apparatus of claim 1, wherein the object assembly module 
comprises a reassembler to assemble the intercepted packets into flows. 

3. (Original) The apparatus of claim 2, wherein the object assembly module 
further comprises a protocol demultiplexer to sort the assembled flows by protocol. 

4. (Original) The apparatus of claim 3, wherein the object assembly module 
further comprises a protocol classifier to extract the objects from the sorted assembled 
flows. 

5. (Original) The apparatus of claim 1, wherein the object classification module 
determines whether objects are stored in the object store or discarded based on one or 
more capture rules. 

6. (Original) The apparatus of claim 5, wherein the capture rules are user- 
configurable through the user interface. 
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7. (Original) The apparatus of claim 1, wherein the object classification module 
determines a location that each object is stored in the object store based on the type of 
content of each abject, 

8. (Original) The apparatus of claim 1, wherein the object classification module 
determines the type of content of each object using a signature of each object. 

9. (Original) The apparatus of claim 1, wherein the user interface comprises a 
graphical user interface. 

10. (Original) The apparatus of claim 1, wherein the object store module 
comprises a content store to store the objects and a tag store to index the objects stored in 
the object store. 

11. (Original) The apparatus of claim 10, wherein the content store comprises a 
canonical storage, and the tag store comprises a database. 

12. (Currently Amended) A method comprising: 
intercepting data being transmitted on a network- 
reconstructing flows of objects being transmitted on the network from the 

intercepted data; 

classifying the reconstructed objects by content type; 
creating a tag to describe each reconstructed object; 
storing the classified objects and tags; and 

indexing the stored objects to enable searching of the stored objects via the 
tags,, wherein the oblects are searched based on a query, which includes search 
criteria used to identify sele cted objects that match the search criteria . 
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13. (Previously Presented) The method of claim 12, wherein reconstructing the 
objects comprises: 

sorting the intercepted data into packets; and 
sorting the assembled flows by protocol. 

14. (Original) The method of daim 12, further comprising determining whether 
each object is to be stored based on a set of one or more capture rules. 

15. (Original) The method of claim 12, further comprising receiving a query over 
the stored objects. 

16. (Original) The method of claim 15, further comprising searching the indexed 
objects, and retrieving objects matching the query. 

17. (Currently Amended) A machine-readable storage medium having stored 
thereon data representing instructions that, when executed by a processor, cause the 
processor to perform operations comprising: 

intercepting data being transmitted on a network; 

reconstructing flows of objects being transmitted on the network from the 
intercepted data; 

classifying the reconstructed objects by content type; 
creating a tag to describe each reconstructed object; 
storing the classified objects and tags; and 

indexing the stored objects to enable searching of the stored objects via the 
tags, wherein the objects are searched b ased on a query, which includes search 
criteria used to identify selected o bjects that match the search criteria . 
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18. (Previously Presented) The machine-readable storage medium of claim 17, 
wherein reconstructing the objects comprises: 

sorting the intercepted data into packets; and 
sorting the assembled flows by protocol. 

19. (Previously Presented) The machine-readable storage medium of claim 17, 
wherein the instructions further cause the processor to determine whether each object is to 
be stored based on a set of one or more capture rules. 

20. (Previously Presented) The machine-readable storagejnedium of claim 17, 
wherein the instructions further cause the processor to receive a query over the stored 
objects, search the indexed objects in response to the query, and retrieve objects matching 
the query. 
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